CVE-2026-49380: JetBrains TeamCity SAML Open Redirect Vulnerability

Technical summary

The SAML plugin in TeamCity before 2026.1 fails to properly validate redirect destinations, allowing an unauthenticated attacker to craft a specially formed URL that performs an open redirect after successful SAML authentication. The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site) and requires a user to click a malicious link and complete authentication. The CVSS 3.1 score of 3.1 reflects the requirement for user interaction and limited confidentiality/availability impact, with only integrity slightly affected through redirection to untrusted content.

Business impact

The primary business risk is reputational and user trust. A successful attack typically involves redirecting authenticated users to phishing sites or credential harvesters, potentially capturing second-factor authentication tokens or session cookies if the redirect occurs post-login. For organizations using TeamCity as a CI/CD gating system, compromise of user accounts could lead to unauthorized pipeline modifications or supply chain risk. However, the low severity rating and high interaction barrier limit the likelihood of widespread exploitation in typical environments.

Affected systems

JetBrains TeamCity installations running versions prior to 2026.1 are affected. The vulnerability is specific to the SAML plugin component, so only deployments using SAML for single sign-on are directly vulnerable. Air-gapped or internally-only SAML implementations face lower attack surface than those accessible from the internet.

Exploitability

Exploitability is low to moderate. An attacker must craft a malicious URL and trick a user into clicking it—there is no automatic or network-based attack vector. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting no widespread active exploitation in the wild at this time. The attack requires prior knowledge of the target's TeamCity instance URL and SAML configuration, making opportunistic attacks less likely than targeted spear-phishing campaigns.

Remediation

Upgrade TeamCity to version 2026.1 or later. JetBrains has addressed the open redirect validation issue in that release. For organizations unable to upgrade immediately, restrict external access to TeamCity instances to trusted networks and educate users to verify redirect destinations before interacting with authentication links, particularly those arriving via email.

Patch guidance

Review the JetBrains TeamCity release notes and advisory for version 2026.1 to confirm the SAML plugin fix is included and to identify any other improvements in that release. Test the upgrade in a non-production environment first, as SAML plugin updates can affect authentication workflows. After patching, verify that SAML redirect functionality operates normally for legitimate use cases. Document the patch date for compliance records.

Detection guidance

Monitor TeamCity access logs for unusual redirect parameters in SAML authentication URLs, particularly those containing domain names or hostnames not in your organization's approved list. Look for authentication requests followed by redirects to external domains. If possible, enable detailed SAML plugin logging to capture redirect destinations during authentication flows. Endpoint detection and response (EDR) tools should flag instances where users are redirected post-authentication to previously unseen domains, though this may generate false positives in multi-tenant or federated environments.

Why prioritize this

Although the CVSS score is low, the vulnerability should still receive attention because it enables credential theft and phishing vectors against developers and CI/CD system administrators—high-value targets in supply chain attacks. The attack requires user interaction but is relatively simple to construct. Prioritize patching for internet-facing TeamCity instances; internal-only deployments can be addressed during regular maintenance windows.

Risk score, explained

The CVSS 3.1 score of 3.1 (LOW) reflects the combination of network accessibility, high attack complexity (user interaction required), low privileges needed, and limited impact. There is no loss of confidentiality or availability, and integrity impact is limited to redirection. The low score appropriately captures that this is not an unauthenticated remote code execution or full authentication bypass; however, security teams should not interpret 'low' as 'ignore,' as open redirects in authentication flows remain tactically useful for social engineering.

Frequently asked questions